Spec Driven Development
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
作者による説明(英語の原文)
MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/LLM08), x402-payable
この3つを1つのスコアにまとめることはしません。意見、測定、人気はそれぞれ別のものだからです。
このサーバーのやさしい解説はまだ書いていません。以下はレジストリから読み取った事実です。
使っているAIアプリを選んで、設定をコピーしてください。
必要なもの
どのアプリを使っていますか?
上でアプリを選んでください。選んだアプリを覚えておくので、次からはボタンに「…にインストール」と表示されます。
ウェブ、デスクトップ、モバイルのClaudeで使えます:
https://x402-data-api.sigrunner.workers.dev/mcpClaude Desktop → Settings → Developer → Edit Config を開き、claude_desktop_config.json にこれを貼り付けます
{
"mcpServers": {
"tech-risk": {
"command": "uvx",
"args": [
"greyridge-x402-tools"
]
}
}
}ターミナルでこれを実行します
claude mcp add --transport http tech-risk https://x402-data-api.sigrunner.workers.dev/mcpclaude mcp add tech-risk -- uvx greyridge-x402-toolsプロジェクトの .cursor/mcp.json、または ~/.cursor/mcp.json に貼り付けます
{
"mcpServers": {
"tech-risk": {
"url": "https://x402-data-api.sigrunner.workers.dev/mcp"
}
}
}プロジェクトの .cursor/mcp.json、または ~/.cursor/mcp.json に貼り付けます
{
"mcpServers": {
"tech-risk": {
"command": "uvx",
"args": [
"greyridge-x402-tools"
]
}
}
}ブラウザがアプリを開いてよいか確認し、そのあとアプリが設定を表示して確認を求めます。キーの値は空欄のままなので、自分で入力してください。
プロジェクトの .vscode/mcp.json に貼り付けます
{
"servers": {
"tech-risk": {
"type": "http",
"url": "https://x402-data-api.sigrunner.workers.dev/mcp"
}
}
}プロジェクトの .vscode/mcp.json に貼り付けます
{
"servers": {
"tech-risk": {
"type": "stdio",
"command": "uvx",
"args": [
"greyridge-x402-tools"
]
}
}
}ブラウザがアプリを開いてよいか確認し、そのあとアプリが設定を表示して確認を求めます。キーの値は空欄のままなので、自分で入力してください。
ChatGPTがつなげるのは、インターネット上のサーバーだけです:
https://x402-data-api.sigrunner.workers.dev/mcpメニューの名前は、プランや時期によって少し違うことがあります。
選んだアプリは、この端末のCookieに保存されます。アカウントは不要です。
この設定は、作者のレジストリ登録情報から作成しています。READMEと違う場合は、READMEに従ってください。
ツールの名前と説明は、サーバーが2026年11月6日に返したそのままの内容です。書いたのは作者で、私たちではありません。プレーンテキストとして表示しています。
enrich_tech_riskSecurity enrichment: tech-stack fingerprint + CVE mapping + EPSS + CISA KEV + verdict (clear/review/block) for a domain. Cost: $0.005 USDC per call (x402 micropayment).
enrich_domainFirmographic + tech-stack enrichment: RDAP registrant/registrar, DNS records, full subdomain enumeration + certificate-transparency history, tech-stack fingerprint, verdict (clear/review/block, based on domain age) for a domain. Cost: $0.005 USDC per call via the shared MCP payme
scan_mcp_serverSecurity-audit a target MCP server for prompt-injection / tool-poisoning. Fetches the server's advertised tools and statically analyzes each for hidden instructions, data-exfiltration hints, dangerous capabilities, cross-tool shadowing, and invisible-unicode payloads (OWASP LLM01
scan_mcp_previewFREE preview scan of a target MCP server for tool-poisoning / prompt-injection. Returns issue count, severity breakdown, risk score, and verdict (clear/review/block) — but NOT which tools or the evidence. Use this to check any MCP server (including your own) at no cost; if issues
crypto_pricesLive spot token prices (price, change_24h, symbol, confidence, timestamp) for CoinGecko ids, sourced from DefiLlama. Cost: $0.005 USDC per call via x402.
crypto_fundingLive 6-venue perpetual-futures funding rates from Binance+Bybit+OKX+Hyperliquid+dYdX+Gate (per-venue rate, per-venue open interest in USD, an OI-WEIGHTED CEX↔DEX arb verdict — funding_spread_bps + cheapest-long/richest-short venue computed over an OI-screened set so a thin-book o
defi_yieldsLive DeFi lending/LP yield pools, and every pool is tagged with an entry verdict (SUSTAINABLE | DECAYING | OUTLIER | AVOID) + a 0-100 risk_score right in the list — a go/no-go at the browse stage, not just raw rows. Each row carries project, chain, symbol, pool id, APY breakdown
yield_entry_verdictPer-pool DeFi yield-entry go/no-go. Pass a DefiLlama poolId (the 'pool' field from defi_yields) and get a packaged SUSTAINABLE | DECAYING | OUTLIER | AVOID verdict + 0-100 risk score + field-cited reasons, built from the pool's APY trend (1d/7d/30d), DefiLlama stability forecast,
simulateWill this Base transaction revert? Prospective-tx dry-run via eth_simulateV1: pass from, to, optional data (0x calldata) and value (wei) and get will_revert + revert_reason + gas_used + token asset_changes BEFORE the agent spends gas sending it. Keyless, Base-native, Tenderly/Alc
pm_marketsLive Polymarket prediction-market data — question, outcomes, outcome prices, bestBid/bestAsk/spread, volume24hr/volume1wk, oneDayPriceChange, clobTokenIds, conditionId, category tags, liquidity, end date — ranked by volume24hr. Cost: $0.005 USDC per call via x402.
crypto_prices_previewFREE 1-item sample of live token prices. No payment required.
crypto_funding_previewFREE 1-item sample of live cross-venue funding rates. No payment required.
defi_yields_previewFREE 1-item sample of live DeFi yield pools. No payment required.
yield_entry_verdict_previewFREE sample yield-entry verdict for the current top-TVL pool. Shows the packaged SUSTAINABLE/DECAYING/OUTLIER/AVOID + risk-score output shape before you pay. No payment required.
simulate_previewFREE sample prospective-tx dry-run (benign 0-value call) showing the will_revert/gas_used/asset_changes output shape before you pay. No payment required.
pm_markets_previewFREE top-1 sample of live Polymarket prediction markets, ranked by volume24hr. No payment required.
chain_block_numberCurrent Base mainnet block number via multi-provider JSON-RPC (automatic failover across 4 providers, never fails on one provider's rate limit). Cost: $0.005 USDC per call via x402.
chain_gas_priceCurrent Base mainnet gas price (wei/gwei), EIP-1559 base_fee_gwei/priority_fee_gwei, and gas_price_usd (ETH price cross-call — no price oracle on ETH-only competitors) via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.
chain_balanceNative ETH balance of a Base mainnet address, incl. balance_usd (ETH price cross-call — no price oracle on ETH-only competitors), via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.
chain_token_balanceERC-20 token balance of a Base mainnet address via multi-provider JSON-RPC, incl. symbol/decimals/balance_formatted (per-token-contract cached in-isolate). Cost: $0.005 USDC per call via x402.
chain_txTransaction details by hash on Base mainnet via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.
chain_walletWallet screening bundle (balance, activity, contract vs EOA check): ETH balance + balance_usd (ETH price cross-call) + tx count + contract-code check (EIP-7702 delegated-EOA aware) for a Base mainnet address, in one call. Cost: $0.005 USDC per call via x402.
chain_wallet_screenIs this wallet sanctioned OR a known scammer? Pre-trade screen for a counterparty / recipient / token-spender address before an agent sends, swaps or approves: exact match against (1) the U.S. Treasury OFAC SDN crypto-address list and (2) community scam/phishing/wallet-drainer th
x402_preflightShould an agent pay this x402 endpoint? Pre-payment check of an UNKNOWN x402 URL: fetch it once (never pays) to validate the 402 challenge + accepts[] (scheme/network/payTo/amount/asset/resource = will it settle) AND label its LIVENESS (LIVE | ZOMBIE | DEAD — is it a working paya
x402_receipt_verifyDid my x402 payment actually settle? POST-payment on-chain proof — the other half of x402_preflight (which checks BEFORE paying). Bring your Base settlement tx hash + the resource URL you paid, and this reads the tx receipt from Base mainnet, decodes its USDC Transfer events, and
x402_receipt_verify_previewFREE keyless x402 settlement check on Base: pass a tx hash plus payto (and optionally expect, in USDC). Dual-RPC reads the receipt, decodes USDC Transfers and returns SETTLED | UNDERPAID | WRONG_RECIPIENT | NO_TRANSFER | REVERTED | NOT_FOUND. Binds to the payTo you supply; resolv
chain_token_securityToken security / honeypot detector for a Base mainnet ERC-20: EIP-1967/1822 proxy + upgradeability detection, bytecode dispatcher scan for mint/pause/blacklist/fee-setter/ownership selectors, owner() renouncement check, and a live eth_call state-override simulation testing whethe
chain_block_number_previewFREE live sample of the current Base mainnet block number — identical data to the paid chain_block_number tool. No payment required.
chain_gas_price_previewFREE live sample of the current Base mainnet gas price — identical data to the paid chain_gas_price tool. No payment required.
chain_token_reportToken security check (honeypot detector + rug-pull risk score) for a Base ERC-20 in one call, decision-grade trade-safety verdict: SAFE | CAUTION | AVOID plus risk_score (0-100) and reasons, bundling honeypot/sellability simulation, owner-renounced + mint/pause/blacklist/fee-sett
gate_swapPre-trade GO / HOLD / BLOCK gate for a Base ERC-20 swap: honeypot/sellability + admin-control checks + Uniswap v3 liquidity vs. your trade size. Returns a top-level `sized_verdict` one-liner (decision + pool-depth % + max-safe size + round-trip breakeven + exit recovery, read in
gate_swap_previewFREE live sample of the gate_swap pre-trade GO/HOLD/BLOCK decision for a demo Base token (usdc|weth|cbbtc|aero|degen), same shape as the paid gate_swap tool. The paid gate_swap tool additionally returns a top-level `sized_verdict` one-liner plus the full `sizing` object (entry/ex
chain_token_report_previewFREE full real trade-safety report (SAFE/CAUTION/AVOID verdict) for Base USDC, same depth as the paid chain_token_report tool. No payment required.
chain_token_security_previewFREE full real analysis of a fixed well-known token (Base WETH) via the token security / honeypot detector — same depth as the paid chain_token_security tool, so you can see the real product before paying. To analyze an arbitrary token, use the paid chain_token_security tool. No
誰でも見られる情報をチェックしており、コードは読んでいません。当てはまらない項目は数に入れていません。 · 2026年11月6日にチェック
レジストリ名は、リポジトリを所有するGitHubアカウント rezearcher で確認済みです
このリポジトリはまだGitHubから読み取っていません
このリポジトリはまだGitHubから読み取っていません
267ミリ秒で応答(HTTP 200)
サインイン不要
34件のツールの説明を読み、AIへの隠れた指示は見つかりませんでした
レジストリでこのカテゴリにある有効なすべてのサーバーと比較しています。スターは、公開者がリポジトリの所有者である場合だけ数えます。
当てはまる基本チェック3項目のうち3項目に合格しました。コードは読んでいません。キーやトークンを追加する前に、サーバーがどんなアクセスを求めているかを確認し、必要な権限だけを持つキーを使ってください。
レジストリには必須のキーは載っていません。ただし、最初に使うときにサインインを求めるサーバーもあります。
どちらでも使えます。パソコンにインストールしても、クラウド版につないでもかまいません。
GitHubリポジトリの最終更新は–、最新バージョン(1.4.0)がレジストリに届いたのは一昨日です。
Claude Desktop、Claude Code、Cursor、VS CodeなどのMCP対応アプリで使えます。URLでつながるので、リモートMCPサーバーに対応したアプリ(開発者モードのChatGPTなど)でも使えます。
同じカテゴリには:Spec Driven Development, Remote Desktop Commander, debuff
同じカテゴリで、ほかの作者が作ったサーバー。スターの多い順。
カードの見方:★ GitHubスターi3つの柱:レビュー · チェック · 利用状況i更新=最新バージョンをレジストリに公開した日i
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Let coding agents play, test and tune your 2D web game: live state, explained errors, replays, fuzz.
作者のリポジトリから書かれたとおりにコピーしたものです。PopNx MCPは内容を確認・推奨していません。HTML、画像、スクリプトは取り除いています。リンクはこのサイトの外へ移動します。
Pay-per-call crypto, DeFi, prediction-market, and on-chain data for AI agents — plus MCP security scanning — over the [x402 payment protocol](https://x402.org) on Base mainnet.
No account, no API key, no subscription. An agent pays inline in USDC (from $0.001/call) and gets the data back in the same request. Every data endpoint has a free preview so an agent can taste the payload before paying.
https://x402-data-api.sigrunner.workers.devhttps://x402-data-api.sigrunner.workers.dev/mcphttps://x402-data-api.sigrunner.workers.dev (same API)/.well-known/x402 · /openapi.json · /llms.txteip155:8453), USDC. Settles via the non-custodial xpay facilitator — no Coinbase/CDP account needed. Also listed on the CDP x402 Bazaar./scan/mcp, $0.05) — a prompt-injection / tool-poisoning audit of an MCP server's tools (OWASP LLM01/LLM08). Zero-egress: for private/OAuth-gated servers you POST only the tools/list JSON — nothing else leaves your side. *There is no free equivalent for this* (unlike token-safety, where free multi-chain scanners exist). Free preview: POST /scan/mcp/preview. CI gate (on the GitHub Marketplace): uses: rezearcher/greyridge-x402-tools@v0.3.2./gate/swap, $0.008 · /chain/token-report, $0.01) — a *decision* (GO/HOLD/BLOCK, SAFE/CAUTION/AVOID) sized to your trade, not raw flags your agent has to interpret. Base-native; if you trade other chains, keep your multi-chain scanner and use this on Base.Everything below is the full catalog (crypto/DeFi data, on-chain reads, LLM, enrichment). Measured reliability at /status (not an SLA).
| Endpoint | Price | Returns |
|---|---|---|
GET /crypto/prices?coins=bitcoin,ethereum,solana | $0.001 | Spot token prices (DefiLlama), keyless. Up to 25 CoinGecko ids. |
GET /crypto/funding?limit=20 | $0.001 | Cross-venue perp funding rates (Hyperliquid + OKX, graceful fallback) with the funding spread + best long/short venue — the arb signal, not just a single-venue list. |
GET /defi/yields?limit=20&project=&chain=&stable= | $0.001 | Top DeFi lending/LP yields (DefiLlama) with APY breakdown, 7d/30d APY trend, IL risk, and DefiLlama's stability forecast — decision-grade, not a raw list. |
GET /pm/markets?query=&limit=20 | $0.005 | Live Polymarket prediction markets: question, outcomes, prices, volume, liquidity, end date. |
Base-native, multi-provider RPC with automatic failover (never fails a paid call on one provider's rate limit).
| Endpoint | Price | Returns |
|---|---|---|
GET /chain/block-number | $0.001 | Current Base block number |
GET /chain/gas-price | $0.001 | Current gas price (wei + gwei) |
GET /chain/balance?address= | $0.001 | Native ETH balance |
GET /chain/token-balance?address=&token= | $0.001 | ERC-20 token balance |
GET /chain/tx?hash= | $0.001 | Transaction details |
GET /chain/receipt?hash= | $0.001 | Transaction receipt (status, gas used, logs) |
GET /chain/code?address= | $0.001 | Contract-code check — is it a contract, and EIP-7702 delegated-EOA detection (is_eip7702_delegate / delegate_address) |
GET /chain/wallet?address= | $0.003 | Bundle: ETH balance + tx count + contract flag in one call, EIP-7702 delegated-EOA aware (is_eip7702_delegate / delegate_address) |
| Endpoint | Price | Returns | |
|---|---|---|---|
| `GET /gate/swap?token=0x…&side=buy\ | sell¬ional_usd=N` | $0.008 | Pre-trade go/hold/block decision for any Base ERC-20: safety verdict, risk score, pool liquidity and price-impact of your size, flags. One call before an agent swaps. Free live sample: /gate/swap/preview |
GET /chain/token-report?token=0x… | see /openapi.json | Full token due-diligence report (security + liquidity + metadata) in one call |
| Endpoint | Price | Returns |
|---|---|---|
GET /scan/mcp?url= | $0.05 | Security audit of a target MCP server: tool-poisoning / prompt-injection / exfiltration / dangerous-capability / hidden-unicode (OWASP LLM01/LLM08) + risk score |
POST /scan/mcp {"tools":[…]} | $0.05 | Zero-egress audit — paste your own tools/list array; same itemized findings, nothing leaves your side and we never fetch/call your server. For OAuth-gated or private MCP servers that won't expose a URL |
GET /enrich/tech-risk?domain= | $0.05 | Tech-stack fingerprint → CVE (NVD) + EPSS + CISA-KEV attack-surface risk |
GET /enrich/domain?domain= | $0.01 | Firmographic + tech-stack enrichment, incl. full subdomain enumeration (subdomains[]) via crt.sh certificate-transparency logs, RDAP, DoH, HTTP fingerprint |
| Endpoint | Price | Returns |
|---|---|---|
GET /x402/preflight?url= | $0.001 | Pre-pay check on any x402 endpoint: will it settle, is the payee safe (OFAC / scam lists), price accuracy, delivery readiness, liveness → PAY / CAUTION / AVOID |
GET /x402/receipt-verify?tx=&url= | $0.004 | Post-pay proof: reads the Base settlement tx from two independent RPCs and reconciles the USDC Transfer against the endpoint's own live 402 (payTo + amount) → SETTLED / UNDERPAID / WRONG_RECIPIENT / NO_TRANSFER / REVERTED / NOT_FOUND / UNVERIFIED |
Free in MCP: x402_receipt_verify_preview (tx + payto, no payment).
Python agents, no key or wallet: uvx --from greyridge-x402-tools greyridge-x402-verify runs a local stdio MCP server (PyPI 0.6.0) with free x402_preflight and x402_receipt_verify tools. Add it to Claude Desktop/Cursor as command uvx, args --from greyridge-x402-tools greyridge-x402-verify.
Try it now, no key: curl "https://api.greyridgesignals.ai/x402/preflight/preview?url=https://api.greyridgesignals.ai/defi/yields" returns verdict: PAY, will_settle: true with the per-check detail (reachability, challenge, accepts, price accuracy, delivery).
Drop-in safe pay wrapper (free preflight, refuses AVOID, then dual-RPC receipt check on the settlement tx):
pip install greyridge-x402-tools (0.7.0), from greyridge_x402.safe_fetch import safe_fetchnpm install github:rezearcher/greyridge-x402-tools, import { safeFetch, PreflightBlocked } from "greyridge-x402-tools" (pass your own x402 fetch, e.g. wrapFetchWithPayment)Already paying with @x402/fetch, wrapFetchWithPayment or a payer MCP such as Crypto APIs' x402_pay? Those pay and hand back the response body; none of them checks that the settlement tx actually moved the advertised amount to the advertised payTo. Keep your payer, and add the verify step after it: pass the tx hash from the X-PAYMENT-RESPONSE header and the URL you paid to x402_receipt_verify. It returns SETTLED, UNDERPAID, WRONG_RECIPIENT, NO_TRANSFER, REVERTED or NOT_FOUND. The x402 FAQ tells buyers to check the transaction themselves; this is that check, in one call.
How x402_receipt_verify differs from the read-only verifier @tensorfeed/x402-base-mcp (verify_x402_settlement, checked against its 0.2.1 README): theirs matches a Transfer against a recipient and amount the caller types in. Ours can pull payTo and amount from the endpoint's live 402 (?url=), so a wrong or stale expectation doesn't pass, and it compares two RPC providers and fails closed if they disagree. Theirs is a good fit if you just want generic Base reads (balances, eth_call) in the same server; ours only does verification.
Free previews: GET /crypto/prices/preview, /crypto/funding/preview, /defi/yields/preview, /chain/block-number/preview, /chain/gas-price/preview (full live data, not truncated), /scan/mcp/preview?url=. Zero-egress MCP scan (for private/OAuth-gated servers): POST /scan/mcp/preview with {"tools":[…]} is the free counts-only preview; POST /scan/mcp with the same body is the paid itemized scan — nothing leaves your side. One-liner: examples/mcp-scan-preview.sh.
Add one remote MCP server and your agent gets the whole toolset. initialize and tools/list are free so agents can discover the tools; paid tools/call returns an x402 challenge.
tools/list advertises 22 tools: crypto_prices, crypto_funding, defi_yields, pm_markets, chain_block_number, chain_gas_price, chain_balance, chain_token_balance, chain_tx, chain_wallet, chain_token_security (paid Base RPC + data, EIP-7702 delegated-EOA aware), crypto_prices_preview, crypto_funding_preview, defi_yields_preview, pm_markets_preview, chain_block_number_preview, chain_gas_price_preview, chain_token_security_preview (free), and scan_mcp_server, scan_mcp_preview, enrich_tech_risk, enrich_domain (security).
// add to your MCP client config
{ "mcpServers": { "grey-ridge-x402": { "type": "streamable-http", "url": "https://x402-data-api.sigrunner.workers.dev/mcp" } } }
mcp-client/ — the stdio companion)For stdio-only MCP clients (Claude Desktop, Cursor, CLI agents), the repo ships a companion package, x402-data-api-mcp, in mcp-client/. It runs on the agent's own machine, speaks MCP over stdio, and proxies to the same Worker /mcp endpoint — it adds no data surface, just a transport + x402 payment shim so stdio-only clients can reach the same tools (22 tools, including paid ones when a wallet key is configured).
Install / run (local path). The package is not yet published to npm, so run it from the repo:
cd mcp-client
npm install npm run build # tsc → dist/server.js node dist/server.js # start (or: npm start)
Published path (one line, no clone): npx @grey-ridge/x402-data-api-mcp — the package is live on npm; its bin target is dist/server.js, so npx runs the same server.
Configuration. Copy mcp-client/.env.example to .env in mcp-client/: WORKER_BASE_URL defaults to the deployed Worker (set it only to point at your own mirror), and X402_WALLET_PRIVATE_KEY is optional — set it to auto-settle paid tools (HTTP 402) via x402; leave it empty to run only the free/preview tools. The client reads both straight from process.env at startup.
// stdio client config (local path)
{ "mcpServers": { "grey-ridge-x402-local": { "command": "node", "args": ["/absolute/path/to/mcp-client/dist/server.js"] } } }
BASE=https://x402-data-api.sigrunner.workers.dev
curl -s "$BASE/crypto/funding/preview"
curl -i "$BASE/crypto/funding?limit=10"
Any x402-capable client (e.g. the x402 libraries) handles the 402 → sign → retry automatically.
Uptime and latency per safety route are measured from a probe cron and published in docs/STATUS.md (regenerated hourly; window
冒頭だけを表示しています。続きはリポジトリで読めます